Check Point Confirms Active Exploitation of VPN RCE CVE-2026-85102
Tech GuruQuick Answer
Check Point reports active exploitation of CVE-2026-85102, a pre-authentication code-execution flaw in Security Gateway VPN certificate handling. Match each Security Gateway or Spark appliance to sk1000117 and the fixed takes/builds below, then investigate anomalous Mobile Access logins and follow-on internal scanning. The vendor report establishes campaign activity, not compromise of your gateway.
Confirm Scope And Apply The Supported Fix
What to do now: Record each gateway's release and hotfix, use sk1000117 to select the supported fix, and preserve logs before disruptive changes. Treat patching and investigation as separate tasks; the installed version alone cannot exclude earlier compromise.
Verification scope: sk1000117, last modified September 24, was read in full from its embedded support-page data on October 2. Package installation and gateway tests have not been performed by TechGeeks.
Scope And Authority
| Product scope | Check Point Security Gateways and Spark appliances in the affected R81 and R82 streams |
|---|---|
| Advisory | sk1000117 |
| CVE | CVE-2026-85102 |
| Authoritative release date | Support record created 2026-09-07; the vendor blog dates fix availability to 2026-09-09. |
| Authority revision date | Support record last modified 2026-09-24; the blog's exploitation update is dated September 22. |
| Affected versions | Security Gateway R81.20, R82 and R82.10; EOS R80/R80.10/R80.20/R80.30/R80.40/R81/R81.10; Spark R81.10.x and R82.00.x, with the advisory's VPN configuration conditions. R82.20 is listed as unaffected. |
| Fixed version | Jumbo Hotfix: R82.10 Take 44, R82 Take 126, R81.20 Take 166, R81.10 Take 190 or later in the corresponding train. Spark: R82.00.10 Build 2325 or R81.10.17 Build 4968, or later applicable builds. LivePatch Take 26 is an alternative for R82.10, R82 and R81.20; see the coverage correction below. A fix for an EOS release does not restore support. |
| CVSS base score | 9.8 (CVSS v3.1) |
| CVSS severity | Critical |
| Exploitation status | Check Point reports exploitation attempts against Spark customers globally. This is vendor-reported activity, not evidence that a particular gateway was compromised. |
What Changed
Check Point says the fix was available on September 9 and that it began observing attempts against Spark customers on September 12. The September 22 blog adds that exploitation context and directs customers to the support advisory for release-specific remediation.
What To Validate Now
- Inventory. Locate Security Gateways and Spark appliances in the listed R80, R81 and R82 release families. Record the exact release, hotfix, enabled VPN features, exposure, owner and dependent services.
- Establish applicability. Match the gateway and VPN configuration to sk1000117. Site-to-site gateways allowing certificate authentication are affected, including DAIP or LSV communities; gateways participating only in PSK-authenticated encryption communities are excluded from that site-to-site path. Do not extend this exception to Remote Access VPN. R82.20 is listed as unaffected.
- Remediate. Install the matching Jumbo/Spark fix above or the supported LivePatch package. Customers who installed the offline LivePatch while running R82.10 Jumbo Take 24 or lower, R82 Take 107 or lower, or R81.20 Take 146 or lower must install LivePatch Take 26 for enhanced coverage. Plan migration from EOS releases even where a security fix is supplied.
- Validate. For LivePatch, run
cpinfo -y CPupdatesin Expert mode and confirm the release-matching urgent-security bundle at Take 26. Check active patches withcplp liston each Security Gateway/ClusterXL member org_all cplp liston a Scalable Platform Security Group; compare the cpcert/cpcert_cprid entries with sk1000117's expected output. Then test VPN authentication, connectivity and recovery. These are vendor instructions, not tests performed here. - Investigate. Review anomalous certificate-based Mobile Access logins and internal port or service scanning from suspicious logged-in users. Do not limit the search to the certificate subjects already published by Check Point.
Operational Cautions
When updating through Jumbo Hotfix or LivePatch is impossible, sk1000117 describes replacing VPN implied rules with explicit peer/client access rules. Incorrect rules can break connectivity; use the complete linked procedure rather than treating a port list as a fix. These mitigation options do not apply to locally managed Spark. Follow sk185114 for offline LivePatch installation and sk179346 for the linked site-to-site rule procedure. Test cluster behavior and recovery; patch completion does not rule out earlier compromise.
Evidence To Retain
- Asset and owner identifiers, exact product and release, architecture or platform, relevant configuration, and the applicability decision.
- UTC timestamps and vendor advisory revision, change approval, before-and-after versions, and installer or package-manager output.
- Relevant logs, validation results, exceptions, compensating controls, and recovery or rollback decisions.
Related TechGeeks Resources
Authoritative References
Correction policy: If the authority changes affected versions, fixed versions, severity, exploitation information, mitigations, or required action, TechGeeks will update this notice and its verification date.
